CVE-2020-79619.8Critical
CVE-2020-7961: Liferay Portal vulnerability
Liferay · Liferay Portal
No fix listed · Affected: Liferay Portal · Exploitation: in CISA KEV since 3 Nov 2021
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue3 Nov 2021
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public10 public GitHub repositories (unverified), listed by PoC-in-GitHub26 Mar 2020
- Not established: not seen
99.9%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
9.8CriticalCVSS
LowMediumHighCrit.
Federal deadline
CISA KEV · added 3 Nov · catalogue entry
Passed 1650 days ago
DescriptionNVD
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
What changed
- CISA added it to the KEV catalogue CISA
- PoC-in-GitHub lists 10 public GitHub repositories (unverified) PoC-in-GitHub
Coverage1 article · 1 outlet
First in our coverage: Infosecurity, 9 Nov.
- Jailbroken AI agent attacked European telecom for two weeksInfosecurity · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.